Your data
The cascade holds nothing between calls — but the product around it has an account, a wallet, an audit trail and your uploads. Here is what each of those is, which store it sits in, how long it survives, and exactly what happens when you press delete.
What we store
The cascade itself is pure compute — it holds no state between calls. The deployed product around it does: an account, a wallet, an audit trail, and your uploads for as long as you need to finish an import.
How · Identity is auth.users.id → tenants.id, populated by a handle_new_user trigger.
How · Dashboard reads run on your own user JWT, so row-level security is the gate — not application code.
Where · MAPR_KV, 24h expirationTtl, service-role access with explicit tenant_id scoping. Never a shared cache.
How · Verification is a signature check plus a revocation read — a leaked database row cannot mint a key.
Where · Supabase audit_logs, workspace-scoped, append-only.
How · Pricing is a prepaid token wallet, so there is no stored payment instrument to charge on a schedule.
We do not collect biometric data, precise geolocation, behavioural analytics, or advertising identifiers. See §2 of the Privacy Policy for the complete list.
Where it lives
“We don’t keep anything” is not a claim we make. This is the actual map: which system holds each thing, how long it survives there, and which identity is allowed to read it back.
| What | Store | Retention | Who can read it |
|---|---|---|---|
| Parsed uploads (may contain PHI) | Cloudflare KV (MAPR_KV), mirrored to Supabase | 24 hours, native TTL | Service role only, with an explicit tenant_id filter on every read |
| Account, wallet, workspace settings | Supabase Postgres | Life of the account | Your own user JWT — row-level security is the gate |
| API keys | HMAC-signed, self-contained | Until you revoke them | Only the identifier is stored; verification needs no lookup |
| Audit trail | Supabase audit_logs | Hash-chained, append-only | Your workspace, plus the auditors you export it to |
| Billing records | Stripe + Supabase metadata | 7 years (accounting law) | Stripe holds the card; we never see it |
| Edge request logs | Cloudflare | 14 days | Operations, metadata only |
Uploads (PHI), connectors (secrets) and the v1 bearer API run service-role with explicit tenant_id scoping; the dashboard plane runs on your user JWT so RLS enforces isolation in the database rather than in application code.
Two modes
Schema-only and full-data are two modes of the same cascade, not two tiers of a plan. Both draw the same small flat per-map fee; only one of them can see a row.
Enforced · The clamp is applied at the HTTP edge in every route that accepts sample rows, and re-applied defensively at the LLM boundary. One chokepoint, clampForSchemaOnly() in lib/parser.ts.
Gated · An explicit PHI request without an acceptance returns 403 agreement_required with a pointer to Settings → Security & Data. There is no silent downgrade to the general catalogue.
PHI routing is off by default: an unconfigured workspace runs standard. Turning it on is an explicit opt-in in Settings → Security & Data, in the same place you accept the BAA/NDA. See how the wallet is charged.
Erasure
“Delete workspace” and “Delete account” destroy the same thing and run the same code path. They used to be two implementations that had drifted — one of them skipped the audit event, the KV purge and the cache clears, and returned success after a failed delete. There is now one.
The erasure intent is written and awaited BEFORE anything is destroyed, so the chain captures it even if a later step fails.
Uploads, connectors, rate-limit counters and Workbench chat memory are deleted explicitly, then the tenant row — which cascades to api_keys, mapping_statistics, tenant_members and audit_logs.
Every upload id from the Supabase list is purged from Cloudflare KV by its canonical key, along with the known per-workspace cache entries.
Entitlements, connectors, workspace settings and agreement caches are invalidated so a warm Worker isolate cannot revive a deleted row.
A destructive-action email is queued through the Worker’s waitUntil so it still lands after the response has flushed and the tenant row is gone.
Neither route may report success when the tenant delete did not happen. A failed erasure returns an error, never “Account deleted.”
# Two buttons, one implementation (lib/workspaceErasure.ts).
# Both require a CSRF token AND a server-side confirmation string.
curl -X DELETE https://adaptivmapr.com/api/v1/me/workspace \
-H "X-CSRF-Token: $CSRF" \
-H "content-type: application/json" \
-d '{"confirm":"delete-my-workspace-<workspace_id>"}'
# The account button is the same cascade behind a different phrase:
curl -X DELETE https://adaptivmapr.com/api/auth/account \
-H "X-CSRF-Token: $CSRF" \
-H "content-type: application/json" \
-d '{"confirm":"delete my account"}'You do not need curl: the same cascade runs from Dashboard → Settings → Account, which asks you to type the confirmation phrase first. Audit and billing records required by tax law are retained for up to seven years; everything else is destroyed immediately. If you cannot reach the dashboard, email dpo@adaptivmapr.com from the registered address with the subject Account deletion request. We action it within one month.
Export & rights
You have the right to receive a copy of your personal data in a machine-readable format (GDPR Art. 20 / nFADP Art. 25), and to access, correct, restrict or object to our processing of it.
Sign in at /dashboard to review your API keys, usage, audit trail and workspace settings. Uploaded files are visible in the Workbench for their 24-hour retention window.
For a JSON export of everything we hold — account record, mapping history, billing metadata — email dpo@adaptivmapr.com with the subject Data export request. We respond within one month.
The complete list of rights is in §8 of the Privacy Policy. AdaptivMapr is HIPAA-ready — we offer a BAA and hold a HIPAA security risk assessment on file — and SOC 2 is in progress. HIPAA is not a certification anyone can hold, so we do not claim one.
Still have a question
Our data protection officer answers directly. If you need the DPA, the subprocessor list, or a BAA before you can evaluate, ask and we will send it.